fix(sandbox): cap the Go daemon's /tools/sync request body

[pedrofrxncx]

The other three obvious daemon body-size gaps in this area (/read, /edit, config-update) are already covered by open PRs #6215, #6039, and #6252 — this fixes a fourth, uncovered one: ToolsSync (POST /_sandbox/tools/sync) decodes the request body with a bare json.NewDecoder(r.Body), with no size limit at all (not even the daemon's general 500MB transfer cap that the fs routes get via decodeBody).

Why it matters: a misbehaving or malicious caller can stream an unbounded body at this route and the daemon buffers it into memory while decoding, which can OOM the process — the daemon's health probe treats a single miss as dead and Studio tears the sandbox pod down mid-session.

Fix: wrap r.Body in http.MaxBytesReader capped at 1MB before decoding — the payload is just a URL plus a handful of headers, never a file transfer, so 1MB is generous headroom, matching the same pattern already used for /dispatch (maxDispatchBodyBytes) and the ConfigUpdate/OrgFsConfig routes in the open #6252 PR.

Regression test: TestToolsSyncRejectsOversizedBody sends a body over the cap and asserts a 400 instead of the decoder buffering it unbounded; TestToolsSyncRejectsMissingURL is an existing-behavior sanity check alongside it.

How to verify: cd packages/sandbox/daemon-go && go test ./internal/routes/... -run TestToolsSync -v

Locally ran: go build ./..., go vet ./internal/routes/..., gofmt -l (clean), and the full go test ./internal/routes/... package (all green). CI runs the rest.

---

Summary by cubic

Caps the Go daemon’s ToolsSync (POST /_sandbox/tools/sync) request body at 1MB to prevent unbounded memory use. Previously the handler decoded the body without a limit; oversized bodies could be buffered into memory and OOM the process.

• Wraps the request body with http.MaxBytesReader (1MB) before json.Decoder, aligning with caps used by dispatch/config routes.
• Behavior change: bodies over 1MB now return 400 Bad Request; normal payloads are unaffected.
• Adds tests: TestToolsSyncRejectsOversizedBody and TestToolsSyncRejectsMissingURL.

^{Written for commit 2050053. Summary will update on new commits.}